Assuring a page is secure - Wikitech-l - lists.wikimedia.org

List overview All Threads
Download

Assuring a page is secure

Identify featured and good...

XML or CSV import?

Tom Doman

7 Dec 2007 7 Dec '07

4:52 p.m.

I am developing an extension for MediaWiki for which I have defined a 'PersonalUrls' hook. When creating the href for my personal URL, I use makeSpecialUrl from the Skin class which generates a relative path. However, I need to guarantee that my page is over https. Does the MediaWiki API set have a way for me to guarantee this? Thanks, Tom

Reply

Show replies by thread

Platonides

7 Dec 7 Dec

5:32 p.m.

Tom Doman wrote:

I am developing an extension for MediaWiki for which I have defined a 'PersonalUrls' hook. When creating the href for my personal URL, I use makeSpecialUrl from the Skin class which generates a relative path. However, I need to guarantee that my page is over https. Does the MediaWiki API set have a way for me to guarantee this? Thanks, Tom

I suppose you could prepend with "https://" . $wgServer, but i think there's some argument for LocalSettings to make absolute URIs.

Reply

Tom Doman

10:05 p.m.

Thanks Platonides, that provides with at least something that will provide the assurance I need through configuration, that's great! Does anyone know if there is a programmatic way for extension writers to accomplish this? Thanks, Tom

>> Platonides <Platonides(a)gmail.com> 12/07/07 10:32 AM >>>

Tom Doman wrote:

I am developing an extension for MediaWiki for which I have defined a 'PersonalUrls' hook. When creating the href for my personal URL, I use makeSpecialUrl from the Skin class which generates a relative path. However, I need to guarantee that my page is over https. Does the MediaWiki API set have a way for me to guarantee this? Thanks, Tom

I suppose you could prepend with "https://" . $wgServer, but i think there's some argument for LocalSettings to make absolute URIs. _______________________________________________ Wikitech- l mailing list Wikitech- l(a)lists.wikimedia.org http://lists.wikimedia.org/mailman/listinfo/wikitech- l

Reply

xaosflux

8 Dec 8 Dec

12:32 a.m.

Have you considered just running your entire site on SSL? en:User:Xaosflux ----- Original Message ----- From: "Tom Doman" <tdoman(a)novell.com> To: <wikitech-l(a)lists.wikimedia.org> Sent: Friday, December 07, 2007 11:52 AM Subject: [Wikitech-l] Assuring a page is secure

I am developing an extension for MediaWiki for which I have defined a 'PersonalUrls' hook. When creating the href for my personal URL, I use makeSpecialUrl from the Skin class which generates a relative path. However, I need to guarantee that my page is over https. Does the MediaWiki API set have a way for me to guarantee this? Thanks, Tom _______________________________________________ Wikitech-l mailing list Wikitech-l(a)lists.wikimedia.org http://lists.wikimedia.org/mailman/listinfo/wikitech-l

Reply

Andrew Garrett

9 Dec 9 Dec

12:31 a.m.

On 12/8/07, Tom Doman <tdoman(a)novell.com> wrote:

However, I need to guarantee that my page is over https. Does the MediaWiki API set have a way for me to guarantee this?

This can be done with the PHP variable $_SERVER['HTTPS'], which will be true if the site was requested using ssl, and false, otherwise. -- Andrew Garrett

Reply

Tom Doman

10 Dec 10 Dec

5 p.m.

Right, but I need to programatically redirect the user to a secure page if they did not arrive at mine from one. I can detect whether it is already secure, but how do I get them there if it's not? - Tom Doman

>> "Andrew Garrett" <andrew(a)epstone.net> 12/08/07 5:31 PM >>>

On 12/8/07, Tom Doman <tdoman(a)novell.com> wrote:

However, I need to guarantee that my page is over https. Does the MediaWiki API set have a way for me to guarantee this?

This can be done with the PHP variable $_SERVER['HTTPS'], which will be true if the site was requested using ssl, and false, otherwise. -- Andrew Garrett _______________________________________________ Wikitech- l mailing list Wikitech- l(a)lists.wikimedia.org http://lists.wikimedia.org/mailman/listinfo/wikitech- l

Reply

Tom Doman

5:07 p.m.

Unfortunately, setting $wgServer only seems to work if the URL specified is an exact match. If I use a bookmark, which may always have something different appended for every user, it will not redirect to a secure page. Even that was a work around for me because I'd prefer not to rely on configuration, however, if it was consistent, it would have been an acceptable thing for which to settle. - Tom Doman

>> "Tom Doman" <tdoman(a)novell.com> 12/07/07 3:05 PM >>>

Thanks Platonides, that provides with at least something that will provide the assurance I need through configuration, that's great! Does anyone know if there is a programmatic way for extension writers to accomplish this? Thanks, Tom

>> Platonides <Platonides(a)gmail.com> 12/07/07 10:32 AM >>>

Tom Doman wrote:

I am developing an extension for MediaWiki for which I have defined a 'PersonalUrls' hook. When creating the href for my personal URL, I use makeSpecialUrl from the Skin class which generates a relative path. However, I need to guarantee that my page is over https. Does the MediaWiki API set have a way for me to guarantee this? Thanks, Tom

I suppose you could prepend with "https://" . $wgServer, but i think there's some argument for LocalSettings to make absolute URIs. _______________________________________________ Wikitech- l mailing list Wikitech- l(a)lists.wikimedia.org http://lists.wikimedia.org/mailman/listinfo/wikitech- l _______________________________________________ Wikitech- l mailing list Wikitech- l(a)lists.wikimedia.org http://lists.wikimedia.org/mailman/listinfo/wikitech- l

Reply

Tom Doman

5:09 p.m.

It's not MY site I'm worried about. I'm concerned with the sites that use my extension. Thus, I need at least a configurable but preferably programmatic solution. - Tom Doman

>> "xaosflux" <xaosflux(a)gmail.com> 12/07/07 5:32 PM >>>

Have you considered just running your entire site on SSL? en:User:Xaosflux ----- Original Message ----- From: "Tom Doman" <tdoman(a)novell.com> To: <wikitech- l(a)lists.wikimedia.org> Sent: Friday, December 07, 2007 11:52 AM Subject: [Wikitech- l] Assuring a page is secure

I am developing an extension for MediaWiki for which I have defined a 'PersonalUrls' hook. When creating the href for my personal URL, I use makeSpecialUrl from the Skin class which generates a relative path. However, I need to guarantee that my page is over https. Does the MediaWiki API set have a way for me to guarantee this? Thanks, Tom _______________________________________________ Wikitech- l mailing list Wikitech- l(a)lists.wikimedia.org http://lists.wikimedia.org/mailman/listinfo/wikitech- l

_______________________________________________ Wikitech- l mailing list Wikitech- l(a)lists.wikimedia.org http://lists.wikimedia.org/mailman/listinfo/wikitech- l

Reply

Simetrical

11 Dec 11 Dec

3:01 a.m.

On 12/10/07, Tom Doman <tdoman(a)novell.com> wrote:

Right, but I need to programatically redirect the user to a secure page if they did not arrive at mine from one. I can detect whether it is already secure, but how do I get them there if it's not?

301?

Reply

6002

days inactive

6006

days old

wikitech-l@lists.wikimedia.org

Manage subscription

8 comments

5 participants

tags (0)

participants (5)

Andrew Garrett
Platonides
Simetrical
Tom Doman
xaosflux